scrubber_rb 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c2ad9752a533c73935b72e5d66553a24ecc1f7aa3d89d1e4e420e64cd3e7d3be
-  data.tar.gz: 68e7b9b45c4470c5e182e6c36fb498d7c3aad86c8ca852d3dfe1513bbdbb9a1c
+  metadata.gz: 47f69ffa8ebd85bccc6260b500f57b6b73c36b14ec5de68fdf31d8a269e69882
+  data.tar.gz: e3061969dfd3168801a5f6750a8074b8dc80caa3e76b0bb394c21bab3e082f25
 SHA512:
-  metadata.gz: ca7640c6d91f3787336e5821f2448a995ff23059c73f132811738304e5a77708eaff82c3b5747a24a3453f21238d9cc7c44cb7917db6ed850a723e82cfbf8ca8
-  data.tar.gz: 818fd4aabd8158ebdf47ced475893c60c8a0f26a4550aeccc996040cec8c531cf47ef8ea409749a38cfb7e7a50d625355043a1d7b89fa02b290d11921834159c
+  metadata.gz: a8929d2e00752f2936db1cff0e3b37d1b7b1a7e177c5b7cd1e37b879ad9796c2104a28aa67a93ab8bd46132a39e6b86e5c5caa6d2725781a51024df3fe1b580f
+  data.tar.gz: 1b38cb4de61590901ff2efc51164e5c9e746f1da2161340a3da47565943bc5d10a01303b82d2e4d7ed1cea4eff3cc8fafbae5fbaa22a52b2e7560ceed89bec06

data/CHANGELOG.md

@@ -7,6 +7,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.1] - 2026-08-16
+
+Documentation only. The native extension is byte-for-byte identical to 0.1.0 —
+if you are already on 0.1.0 there is no functional reason to upgrade.
+
+### Added
+
+- A `vs logstop` section in the README with a scope-matched benchmark
+  (`rake benchmark:logstop`). `scrubber_rb` is restricted to logstop's exact
+  detector set before anything is timed: 153.6 MB/s vs 9.1 MB/s over the 100MB
+  corpus, or 112.9 vs 8.7 with `ip` and `mac` enabled on both.
+- A table of where the two disagree about *what* to redact, in both directions.
+  logstop's card pattern is sixteen digits with no checksum, so it redacts
+  numbers that fail Luhn and misses 15-digit Amex and 19-digit Visa; but it
+  matches percent-encoded values inline and this gem does not.
+
+### Documented
+
+- **Percent-encoded input is not decoded.** `Scrubber.scrub("e=nik%40example.com")`
+  finds no email, because `%40` is not `@`. Decode before scrubbing;
+  `Scrubber::Middleware` already does this for query strings. This behaviour has
+  not changed — it was simply never written down, and it is the kind of gap that
+  should be on the tin rather than discovered in production.
+
 ## [0.1.0] - 2026-08-16
 
 First release.
@@ -55,5 +79,6 @@ First release.
   `aarch64-linux-musl`, `x86_64-darwin`, `arm64-darwin`, plus a best-effort
   `x64-mingw-ucrt` and the source gem.
 
-[Unreleased]: https://github.com/TheSoloHacker47/scrubber-rb/compare/v0.1.0...HEAD
+[Unreleased]: https://github.com/TheSoloHacker47/scrubber-rb/compare/v0.1.1...HEAD
+[0.1.1]: https://github.com/TheSoloHacker47/scrubber-rb/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/TheSoloHacker47/scrubber-rb/releases/tag/v0.1.0

data/README.md

@@ -246,9 +246,42 @@ live on every byte. The Rust core runs one Aho-Corasick pass over the literal an
 (`AKIA`, `-----BEGIN`, `ghp_`, `password`) to eliminate roughly two thirds of the rules before
 any regex runs, then one `RegexSet` pass for the rest.
 
-`logstop` solves a narrower problem (log filtering, pure Ruby, zero native code) and solves it
-well. If that's all you need, use it — it has no native extension to build. Run
-`rake benchmark:logstop` for a scope-matched comparison.
+### vs logstop
+
+[`logstop`](https://github.com/ankane/logstop) solves a narrower problem — filtering log lines,
+in pure Ruby, with no native extension to build — and has been doing it well since 2019. So the
+comparison below restricts `scrubber_rb` to logstop's exact detector set first; running fourteen
+detectors it never claimed to have and calling the result a win would prove nothing.
+
+<!-- generated by `rake benchmark:logstop`; do not edit by hand -->
+
+| detector scope | scrubber_rb | logstop | ratio |
+|---|---|---|---|
+| logstop defaults (`url_password`, `email`, `credit_card`, `phone`, `ssn`) | **153.6 MB/s** | 9.1 MB/s | 16.9x |
+| + `ip` and `mac` | **112.9 MB/s** | 8.7 MB/s | 13.0x |
+
+100MB synthetic log corpus, single thread, ruby 3.3.0 on arm64-darwin24, logstop 0.4.1, best of
+3 passes.
+
+The speed is the less interesting half. Where they differ on *what* to redact:
+
+| input | scrubber_rb (logstop's scope) | scrubber_rb (all detectors) | logstop |
+|---|---|---|---|
+| Amex, valid Luhn, 15 digits | redacted | redacted | — |
+| Visa, valid Luhn, 16 digits | redacted | redacted | redacted |
+| Visa, valid Luhn, 19 digits | redacted | redacted | — |
+| 16 digits, fails Luhn | — | — | redacted |
+| percent-encoded email | — | — | redacted |
+| JWT, AWS key, GitHub token, `password=`, private key, IBAN, IPv6 | — | redacted | — |
+| Aadhaar, valid Verhoeff | — | redacted | — |
+
+Read that in both directions. logstop's card regex is `\b[3456]\d{15}\b` — sixteen digits, no
+checksum — so it redacts numbers that fail Luhn and misses the 15-digit Amex and 19-digit Visa
+lengths entirely. But it also matches percent-encoded values (`%40`, `%2B`, `%3A`) inline, which
+`scrubber_rb` does not; see the limitation below.
+
+If log filtering is all you need and you'd rather not build a native extension, logstop is a
+perfectly good answer. Reproduce this table with `rake benchmark:logstop`.
 
 ## Security
 
@@ -269,6 +302,12 @@ To report a vulnerability, see [SECURITY.md](SECURITY.md).
 Deterministic patterns can't catch free-form PII — **names, home addresses, medical notes**.
 That's NER-model territory. We'd rather be honest about this than give you false confidence.
 
+**Percent-encoded values.** `Scrubber.scrub("e=nik%40example.com")` does not see an email —
+detectors run on the literal bytes, and `%40` is not `@`. Decode before scrubbing.
+`Scrubber::Middleware` does exactly that for query strings, which is why it reports
+`env["scrubber.params"]` rather than scrubbing `QUERY_STRING` in place. If you feed raw encoded
+data to `Scrubber.scrub` yourself, `CGI.unescape` it first.
+
 If your threat model includes free-text PII, layer a model-based pass behind this gem's fast
 structural pass: [`top_secret`](https://github.com/thoughtbot/top_secret) and its
 [`ruby_llm-top_secret`](https://github.com/thoughtbot/ruby_llm-top_secret) integration cover

data/lib/scrubber/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Scrubber
-  VERSION = "0.1.0"
+  VERSION = "0.1.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: scrubber_rb
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Nikhil Nelson